Overview
The Windows Local Security Authority Service Server (LSASS) contains a vulnerability that may permit an attacker to completely compromise the system.
Description
A buffer overflow vulnerability exists in a Microsoft Active Directory service logging function that is exposed by the LSASS DCE/RPC interface. The vulnerability occurs due to the misuse of a vsprintf() call. For a full technical description, please see eEye Digital Security's Advisiory. This vulnerability affects the following systems:
|
Impact
A remote unauthenticated attacker could exploit this vulnerability to execute arbitrary code on the vulnerable system. |
Solution
Apply a patch from the vendor |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
The Microsoft Security Bulletin credits eEye Digital Security for reporting this vulnerability.
This document was written by Jason A Rafail.
Other Information
| CVE IDs: | CVE-2003-0533 |
| Severity Metric: | 35.44 |
| Date Public: | 2004-04-13 |
| Date First Published: | 2004-04-14 |
| Date Last Updated: | 2004-04-14 01:31 UTC |
| Document Revision: | 9 |